The npm package chai-secure versions 1.2.3 and 1.2.5 contains malicious code that executes attacker-controlled JavaScript on the host machine. Upon import, it silently spawns a detached Node.js child process that fetches code from a remote HTTP server and executes it with full privileges. This behavior is hidden from the README and uses evasion techniques such as delivering payload via a 404 response. The package masquerades as a Chai plugin providing assertion helpers but instead performs unauthorized remote code execution.